Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0afd3e7a authored by weichinweng's avatar weichinweng Committed by Weichin Weng
Browse files

HFP: Cleanup bt_hf_callbacks on the jni thread. 

For the race condition, the bt_hf_callbacks will be set null on main
thread when doing btif_hf_upstreams_evt on jni thread. Then it will
trigger crash due to btif_hf_upstreams_evt calling a null point.
The patch is cleanup bt_hf_callbacks on the jni thread to avoid the race
condition.

Bug: 140781191
Test: manual, unit test, auto script stress test.

Change-Id: I67400749120aebe13fa3e791f624c8e595d63379
parent ccb9bfb0

system/btif/src/btif_hf.cc

+7 −3
Original line number Diff line number Diff line
@@ -1360,14 +1360,18 @@ void HeadsetInterface::Cleanup() { 
  BTIF_TRACE_EVENT("%s", __func__);



  btif_queue_cleanup(UUID_SERVCLASS_AG_HANDSFREE);

  if (bt_hf_callbacks) {



  tBTA_SERVICE_MASK mask = btif_get_enabled_services_mask();

#if (defined(BTIF_HF_SERVICES) && (BTIF_HF_SERVICES & BTA_HFP_SERVICE_MASK))

  if ((mask & (1 << BTA_HFP_SERVICE_ID)) != 0) {

    btif_disable_service(BTA_HFP_SERVICE_ID);

  }

#else

  if ((mask & (1 << BTA_HSP_SERVICE_ID)) != 0) {

    btif_disable_service(BTA_HSP_SERVICE_ID);

#endif

    bt_hf_callbacks = nullptr;

  }

#endif

  do_in_jni_thread(FROM_HERE, base::Bind([]() { bt_hf_callbacks = nullptr; }));

}



bt_status_t HeadsetInterface::SetScoAllowed(bool value) {